blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2023-4930

MEDIUM 6.5 CVSS 3.1
Published
November 6, 2023
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-552
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Description

The Front End PM WordPress plugin before 11.4.3 does not block listing the contents of the directories where it stores attachments to private messages, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Front End PM — Before 11.4.3
  • shamimsplugins front_end_pm — Before 11.4.3

References

  • wpscan.com https://wpscan.com/vulnerability/c73b3276-e6f1-4f22-a888-025e5d0504f2 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record